sophos_create_case
Create a new investigation case to document and track security incidents, threats, hunts, or vulnerabilities in your organization.
Instructions
Create a new investigation case.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Case name | |
| type | No | Case type (e.g. 'threat', 'hunt', 'incident') | |
| status | No | Initial case status | |
| assignee | No | Assignee email address | |
| overview | No | Case overview/description text | |
| severity | No | Case severity (e.g. 'notSet', 'high', 'critical') | |
| tenant_id | Yes | Tenant UUID | |
| managed_by | No | Who manages the case ('self' or 'sophos') | |
| other_detection_ids | No | Additional detection IDs to associate with the case | |
| initial_detection_id | No | ID of the initial detection that triggered this case |